6aa08cfff9e4c55600295451f46657a03df50c6457bf225c237ffcaa13a0b64c

Analysis

max time kernel
34s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
10/05/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fa13453ff17052585042af705b4a984_JaffaCakes118.apk
Size

17.3MB
MD5

2fa13453ff17052585042af705b4a984
SHA1

8a786db9dff8ca220b1091af553f8274815f5b1d
SHA256

6aa08cfff9e4c55600295451f46657a03df50c6457bf225c237ffcaa13a0b64c
SHA512

7d1bb5f43bf75b4a3a1b3c3e1ba3181261ad272a71490a74172a1733eb0c16e73ae38917091b8dbe85b83af49de6399e75a7fee50fe891704fa1c66d33958eb2
SSDEEP

393216:DW5iMtENsJ03sbZUzPBe6Z6MBPw5ZprAIYCVmqCJ9Az:i763sSzpR1BIPJA5Az

Score

6^/10

discovery impact

Malware Config

Signatures

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.subway.bjsubway

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.subway.bjsubway

com.subway.bjsubway
1⤵
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4199
- chmod 755 /data/user/0/com.subway.bjsubway/.jiagu/libjiagu.so
  2⤵
  PID:4226
- chmod 755 /data/user/0/com.subway.bjsubway/.jiagu/libjiagu.so
  2⤵
  PID:4275
- /system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.subway.bjsubway/.jiagu/classes.dex --dex-file=/data/data/com.subway.bjsubway/.jiagu/classes.dex!classes2.dex --dex-file=/data/data/com.subway.bjsubway/.jiagu/classes.dex!classes3.dex --oat-file=/data/data/com.subway.bjsubway/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed
  2⤵
  PID:4296

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact